Think before you patch. The idea sounds counterintuitive, because the natural reflex is to fix fast and fix everything. Yet the July 2026 Patch Tuesday proved the opposite: patching everything, in no particular order, has become the wrong reflex. That month, Microsoft fixed more than 600 flaws, an all-time record. But the only two actually being exploited that day scored 5.3 and 7.8 out of 10, while the dozens of critical flaws drew no attacker interest at all.
A 5.3 Flaw Exploited, the Critical Flaws Ignored
On patch day, attackers were exploiting a SharePoint flaw rated 5.3 and an AD FS flaw rated 7.8. The sixty-odd flaws classified as critical, by contrast, were under no known exploitation.
This gap is not an anomaly, it is the rule. The CVSS score is a theoretical severity rating, from 0 to 10, measuring the potential danger of a flaw. It says nothing about the likelihood that the flaw will actually be exploited. Yet only a tiny minority of published flaws is ever used in a real attack.
Patching by score alone therefore means running in the wrong direction. A better starting point exists: CISA’s KEV catalog lists actively exploited vulnerabilities, and CERT-FR flags those affecting the French landscape. These sources tell you what is actually on fire.
Key takeaway: a critical flaw that is never exploited is homework you can hand in late. A medium flaw under active exploitation is a fire.
When Your Antivirus Becomes the Front Door
One of the month’s flaws, nicknamed RoguePlanet, targeted the engine of Microsoft Defender itself. It granted SYSTEM rights, meaning full control of the machine, within seconds. The tool meant to protect you became the tool that compromised you.
The story carries a second lesson. A seller was offering this exploit on a criminal forum, escrow service included, promising administrator access in five seconds. Except that seven free exploits were already circulating publicly and the patch had shipped. The spectacular threat was, in reality, an already-obsolete product.
Two accessible lessons follow. First, your security tools are an attack surface too: an antivirus, a firewall or a monitoring agent must be patched with the same rigour as everything else. Furthermore, not everything sold on the dark web is dangerous. Knowing how to tell a marketing pitch from a real threat saves you from mobilising an entire team over an already-fixed flaw.
When Applying a Patch Brings Down Your Active Directory
The main operational risk of July 2026 came from no hacker at all. It came from the patches themselves, which activated a hardening phase of the Kerberos protocol. Legacy service accounts, still based on RC4 encryption, could stop working on reboot.
A patch is not just a plug over a hole. It is a configuration change, with its own risk. Applied without testing, it can cause the very downtime the attacker failed to achieve. Bringing down your own Active Directory, on a Monday morning at reboot, remains an entirely avoidable outage.
The same month illustrated a neighbouring risk. SharePoint Server 2016 and 2019 reached end of support on 14 July, the very day Microsoft shipped their final patch. For these versions, the question is no longer whether to patch, but whether to migrate. After that date, every new flaw stays open, permanently.
Key takeaway: the patch that protects and the patch that breaks are the same act. Only prior testing separates them.
A Volume That Will Not Come Back Down
The pace seen in July is not an accident but an underlying trend. Microsoft itself attributes the surge to an AI-assisted vulnerability discovery system. The Security Update Guide figures are unambiguous: the volume tripled between June and July 2026.
Unique vulnerabilities fixed by Microsoft (CVEs)
Source: Microsoft Security Update Guide, June and July 2026
This acceleration changes the game, because the same AI also helps attackers turn a patch into an exploit faster than before. The window between a flaw’s publication and its exploitation is shrinking. Consequently, patch processes sized for a rhythm of 200 flaws a month become the weak link against 600.
The nature of the flaws matters as much as their number. In July 2026, elevation of privilege dominates by far, well ahead of remote code execution. In other words, most of these flaws are not used to get in, but to move up once inside: they are the second step of an attack, not the first.
July 2026 flaws by impact type (unique CVEs)
Source: Microsoft Security Update Guide, July 2026
So How Do You Patch in the Right Order?
Three rules do most of the work. Before opening the deployment console, it is worth setting them down in writing.
- Prioritise by real exploitation and exposure, not by score alone. A flaw exploited on an internet-facing server comes before a critical flaw on an isolated internal workstation.
- Deploy in waves: IT workstations, pilot group, general fleet, then servers. Test before you break.
- Write the urgency criterion before the incident, not during. A threshold defined in calm is worth a thousand rushed judgment calls under pressure.
These rules then translate into concrete actions that this Patch Tuesday makes especially clear. First, prioritise the actively exploited SharePoint and AD FS vulnerabilities, and apply the hardening recommended by CISA, notably AMSI full-mode inspection and IIS machine key rotation. Next, verify the Defender engine version across all endpoints, including the network-isolated systems that automatic updates do not reach. Furthermore, the AD FS flaw deserves priority treatment and a review of administrator access logs for abnormal privilege escalation, since this component governs authentication between the internal network and the cloud. It is also worth anticipating what comes next: a SharePoint attack chain enabling unauthenticated remote code execution is due to be completed at the following Patch Tuesday, and the most advanced actors are already reconstructing it from the July patch. Pre-approving changes and testing in staging removes the emergency. Finally, migration of the now-unsupported SharePoint 2016 and 2019 must be planned without delay.
For an organisation subject to NIS2 or DORA, this discipline is not one good practice among others. Patch and vulnerability management is an explicit risk-management obligation.
Key Vulnerabilities Under Active Exploitation
The indicators below are drawn from public, verifiable sources (CISA KEV, Microsoft advisories). They are the actionable starting point for triage.
| Indicator | Type | Context | Source |
|---|---|---|---|
| CVE-2026-56164 | SharePoint, EoP | Missing authentication for a critical function; actively exploited; federal remediation deadline 17 July 2026 | CISA KEV |
| CVE-2026-56155 | AD FS, EoP | Privilege escalation; actively exploited; discovered by Microsoft DART; deadline 28 July 2026 | CISA KEV |
| CVE-2026-58644 | SharePoint, RCE | Chained with CVE-2026-56164 in active exploitation; added to KEV 16 July 2026 | CISA KEV |
| CVE-2026-50656 | Defender engine, EoP | RoguePlanet; grants SYSTEM; fixed in MMPE v1.1.26060.3008 (out-of-band, 9 July 2026) | Microsoft advisory |
| CVE-2026-55040 | SharePoint, auth bypass | JWT bypass; first stage of a two-part unauthenticated RCE chain; second stage expected August 2026 | Rapid7 |
| MsMpEng.exe anomaly | Hunting indicator | Defender engine spawning unexpected child processes; hunt the 10 June to 9 July 2026 exposure window | Vendor research |
Associated MITRE ATT&CK Techniques
Mapping the observed activity to MITRE ATT&CK helps defence teams turn these vulnerabilities into detection and hunting priorities.
| Technique ID | Technique | Relevance |
|---|---|---|
| T1190 | Exploit Public-Facing Application | SharePoint flaws enable unauthenticated remote exploitation of internet-facing servers |
| T1068 | Exploitation for Privilege Escalation | RoguePlanet (Defender), the AD FS flaw and LegacyHive all provide local escalation to SYSTEM or admin |
| T1550.001 | Use Alternate Authentication Material: Application Access Token | The SharePoint JWT bypass enables token forgery to impersonate any user, including administrators |
| T1552.004 | Unsecured Credentials: Private Keys | The exploitation chain steals IIS machine keys from compromised SharePoint servers for persistence |
| T1562.001 | Impair Defenses: Disable or Modify Tools | RoguePlanet exploits Defender’s own engine, subverting the primary endpoint protection control |
| T1505.003 | Server Software Component: Web Shell | Post-exploitation in the SharePoint pattern involves web shell deployment for persistent access |
More than 600 flaws is not the problem. A process that cannot absorb them is. Think before you patch.
What Stroople Monitors on Your Behalf
Stroople’s Threat Exposure Management service combines EASM and data leak detection in a continuous monitoring program. In practice, Stroople tracks your external exposure across open and closed sources: compromised credentials, data surfacing on the dark web, misconfigured assets, orphaned access points at your suppliers. Each alert is qualified by analysts, then delivered with a clear remediation plan.
External Attack Surface Management
See your exposure before attackers do. Know what's already compromised.
of successful breaches start from publicly exposed assets.